# Independent verification receipts

Verified the proposed `@netlify/run-utils` and `@netlify/git-utils` changes from `/tmp/netliloop-work/build` on Linux with Node v24.21.0. Read the checkout's README.md, CONTRIBUTING.md, and Build integration-test documentation before verification.

## Real plugin subprocess boundary

Command (exit 0):

```sh
NETLIFY_VERIFY_REPO_ROOT=/tmp/netliloop-work/build node --no-warnings --loader /tmp/netliloop-work/independent-verification/source-loader.mjs /tmp/netliloop-work/independent-verification/plugin-boundary.mjs
```

Output in `plugin-boundary.log`:

```text
PASS real child boot → IPC load → onBuild → getUtils → Git/execa: mixed changes plus rename
  23 exact path statuses + fileMatch; local bin defaults and explicit override
  Omitted argv cwd/env; child exit errors; default stdout forwarding
PASS real child boot → IPC load → onBuild → getUtils → Git/execa: empty diff
  0 exact path statuses + fileMatch; local bin defaults and explicit override
  Omitted argv cwd/env; child exit errors; default stdout forwarding
```

`plugin-boundary.mjs` forks the real Build `src/plugins/child/main.js`, waits for its real ready handshake, and invokes the real parent `callChild` implementation for IPC `load` and `run` events. The real child loader imports `plugin.mjs`, validates it, dispatches `onBuild`, creates real `getUtils`, and returns plugin status through IPC. No Git, execa, utilities, plugin loading, IPC, environment-change, status, or child process implementation is mocked.

The harness constructs and commits an actual temporary Git repository with created/modified/deleted paths containing Unicode, spaces, tabs, embedded newlines, quotes, backslashes, and a terminal newline. All seven names appear in each change category; a rename contributes one deletion and one addition, for 23 total statuses. It asserts every exact path and exact-name `fileMatch` result. A second real plugin process checks an empty diff. `core.quotePath=true` is configured and a controlled `CACHED_COMMIT_REF` chooses each comparison.

Both plugin invocations also run actual executable fixtures and Node children to check:

- Project-local binary resolution with explicit options and with no options.
- Explicit `preferLocal:false` rejection with ENOENT.
- Omitted argv preserving cwd and a child environment value.
- Existing options-as-second-argument and explicit-argv call forms.
- Propagation of a nonzero child exit code.
- Default output forwarding, observed at the actual plugin subprocess stdout.

### Loader scope and precise limitations

Workspace libraries had not all been emitted, and full build commands were prohibited. `source-loader.mjs` maps workspace package entrypoints from `lib`/`dist` to the corresponding **unmodified source** and resolves sibling `.js` imports to existing `.ts` sources. It uses the installed TypeScript compiler's normal, type-aware emit in memory; third-party dependencies use ordinary Node resolution. It does not rewrite or mock product behavior. Using type-aware emit is necessary for legacy type re-exports in `zip-it-and-ship-it`.

Consequently this validates actual source implementations through the Build plugin child and parent IPC boundary, but does **not** validate published package contents, workspace build emission, top-level Build configuration/scheduling/orchestration, Netlify buildbot or deployment, Windows, or macOS. Exact-name `fileMatch` is covered; micromatch's existing wildcard behavior for newline filenames is outside this change. No full `npm run build` or `netlify build` was run.

## Mutation proof for every new test

Command (exit 0):

```sh
python3 /tmp/netliloop-work/independent-verification/mutations.py
```

The runner copies only each affected package's source, added test, package manifest, and Vitest config to `mutations/`; dependencies are linked read-only in practice from the installed checkout. Each mutation is restored before the next check, including in failure cleanup.

`mutation-receipts.json` contains every exact Vitest command and exit status. `mutations.log` records:

| Check | Exit | Result |
| --- | --- | --- |
| Baseline | 0 | 9 passed |
| Restore old command defaults | 1 | 1 failed, 1 passed |
| Restore old omitted-argv handling | 1 | 1 failed, 1 passed |
| Force preferLocal true, ignoring explicit false | 1 | 1 failed, 1 passed |
| Restore old line-based Git parser | 1 | 6 failed, 1 passed |
| Replace spaces in parsed file paths | 1 | 1 failed, 6 passed |
| Restore all current source | 0 | 9 passed |

Inspected each failure. They fail on real behavior: missing local executable; wrong cwd/missing child variable; a promise resolving instead of the explicit-false ENOENT rejection; quoted/escaped Git filenames; and `space_name.txt` differing from `space name.txt`. No failures are import errors, fixture failures, or source-string assertions. The old parser already passed the space-name case, so the separate space mutation proves that added test. The explicit-false mutation separately proves that guard inside its combined test.

See `mutant-*.log`, `isolated-baseline.log`, and `isolated-restored-green.log` for assertion receipts. Checksums for the four changed files at verification time are in `verified-source.sha256`.

## Rerun against another checkout/branch

Install that checkout's locked dependencies first according to its contribution instructions. Keep this harness directory outside the checkout. On Linux with Node 22+ and Python 3, set a task-specific checkout path, then run:

```sh
export NETLIFY_VERIFY_REPO_ROOT=/absolute/path/to/checkout
VERIFY_DIR=/absolute/path/to/independent-verification
node --no-warnings --loader "$VERIFY_DIR/source-loader.mjs" "$VERIFY_DIR/plugin-boundary.mjs"
python3 "$VERIFY_DIR/mutations.py"
```

The plugin-boundary check may run against the proposed branch or a baseline: a baseline containing the utility defects should fail its behavior assertions. The mutation runner expects the proposed added tests and current fixed implementation because it deliberately reintroduces each defect; it is not intended to run on a branch lacking those tests. These commands recreate disposable Git repositories and isolated package copies only inside the harness directory (plus normal OS temp files used by package tests). `NETLIFY_INTERNAL_GIT=1` is set internally for those temporary repositories. No Netlify site or deployment is required.

## Terminal recording

`plugin-boundary.cast` records a fresh real plugin-boundary execution, and `plugin-boundary.gif` renders it as a 7.08-second, 927×372 animation (31 KB). `plugin-boundary-final.png` is the inspected final frame. The recorded execution prints both PASS results and `Exit status: 0`.

Installed asciinema into `recording-tools/` with pip and downloaded the public agg v1.9.0 Linux x86_64 release into this evidence directory. From this evidence directory, commands (both exit 0):

```sh
PYTHONPATH="$VERIFY_DIR/recording-tools" ASCIINEMA_CONFIG_HOME="$VERIFY_DIR/recording-home" python3 -m asciinema rec --overwrite --cols 108 --rows 18 --env TERM --title 'Netlify Build real plugin utility verification' --command 'python3 record-session.py' "$VERIFY_DIR/plugin-boundary.cast"
"$VERIFY_DIR/agg-x86_64-unknown-linux-gnu" --theme github-dark --font-family 'DejaVu Sans Mono' --font-size 14 --idle-time-limit 1 --last-frame-duration 5 "$VERIFY_DIR/plugin-boundary.cast" "$VERIFY_DIR/plugin-boundary.gif"
```

The recording shows the actual command and test output; the renderer compresses idle pauses to one second and holds the final frame for five seconds.